Very recently, Karati et al. (IEEE Internet of Things Journal, 6(6), PP. 10431-10440, DOI 10.1109/JIOT.2019.2939204, 2019) presented a new generalized CLSC (gCLSC) to provide the functions of digital signature and encryption to fulfill the authenticity and confidentiality for the resource-constrained IoT devices. Karati et al. claimed that the newly proposed gCLSC supports the property of public verifiability and security of an ideal signcryption under the strong Diffie-Hellman and bilinear Diffie-Hellman inversion problems without random oracle model. Unfortunately, their scheme is insecure with respect to unforgeability. It is demonstrated that any receiver or non-privileged user can generate the valid signature or signcrypted ciphertext on any message. Finally, the paper also points out the flaw in their unforgeability proof and gives some suggestion on construction of concrete scheme.

In recent years, healthcare wireless sensor networks (HWSNs) have received extensive attention. Due to the direct participation of patients’ personal health data, privacy issues, and security are very sensitive in HWSNs. How to aggregate the sensitive patient information securely and efficiently is still a challenging task to the HWSNs communication scenario. In this article, a lightweight data aggregation protocol with privacy-preserving is proposed to achieve enhancing security in HWSNs. With the proposed protocol, patients’ personal health data collected by the data collect client can be aggregated by data aggregator and efficiently obtained by the medical service provider in a privacy-preserving manner. In particular, we first propose an efficient certificateless aggregate signcryption scheme, and then, design a data aggregation protocol for patient condition monitoring with information confidentiality, integrity, mutual authenticity, and public verifiability. Performance comparisons show that our newly proposed protocol significantly reduces computing overhead compared to the latest protocols in the field.

Generalized signcryption can adaptively work as an encryption scheme, a signature scheme, or a signcryption scheme with only one algorithm. The paper proposes an efficient certificateless generic signcryption scheme without utilizing bilinear pairing operations. It is proved to satisfy confidentiality and unforgeability against chosen ciphertext and message attacks in an adaptive manner, respectively, in the random oracle model. Due to the lower computational cost and communication overhead, the proposed scheme is suitable for low power and processor devices.

As an extremely significant cryptographic primitive, certificateless signature (CLS) schemes can provide message authentication with no use of traditional digital certificates. High efficiency and provable security without random oracle are challenges in designing a CLS scheme. Recently, Karati, Islam and Karuppiah proposed an efficient pairing-based CLS scheme with no use of map-to-point (MTP) hash function and random oracle model to provide data authenticity in Industrial Internet of Things (IIOT) systems. The security proof was given under several hardness assumptions. However, we notice that both public key replacement attack and known message attack are existing in Karati et al.’s scheme. Any adversary without knowledge of signer’s private key is capable of forging valid signatures. This lead to several serious consequences. For example, anybody can sign IIoT data on behalf of IIoT data owner without being detected.

With the rapid development of the Internet of Things (IoT), data is experiencing exponential growth. To ensure security and privacy, more data is being stored encrypted. Consequently, performing secure and efficient encrypted data search has become a critical challenge. Attribute-based searchable encryption (ABSE) provides fine-grained access control and encrypted search capabilities, making it an effective solution to this problem. However, the high computational overhead of bilinear pairing operations results in increased query latency, imposing a significant burden on resource-constrained IoT devices. Moreover, the security of access policy remains a critical challenge, as improper handling can lead to leakage of user privacy. In this article, we propose an efficient attribute-based multikeyword searchable encryption with access policy hiding in IoT using blockchain. Our scheme adopts an attribute bloom filter for access policy protection and query prefiltering, enabling the rapid elimination of invalid requests that do not satisfy the access policy. This reduces the computational burden of bilinear pairing operations and improves search efficiency. The filtered requests are processed by a cloud server to perform access policy verification and multikeyword search. Additionally, our scheme employs the Interplanetary File System (IPFS) for large-scale encrypted data storage, further enhancing storage efficiency. The blockchain ensures the traceability and tamper resistance of search records, thereby enhancing security. Security analysis and performance evaluation validate the effectiveness and practicality of our scheme, making it suitable for IoT environments.